[Wolfi Package Update]: gocover-cobertura

[jackwhelpton]

Package name

gocover-cobertura

Current version in Wolfi

n/a

Requested version

1.5.0 (latest)

Upstream project URL

https://github.com/boumenot/gocover-cobertura

Problem

Gocover-cobertura is widely used in CI/CD pipelines, where it enables Go coverage reports to be ingested by other tools for reporting purposes (e.g. GitLab, SonarQube)

Being able to install it into CI/CD worker images via the usual package manager would be more secure than using go install.

Steps to reproduce

No response

Root cause (if known)

No response

Proposed solution

No response

Testing performed

No response

Acceptance criteria

• The requested version is the latest stable upstream release (no pre-releases or RCs)
• The upstream project uses an OSI-approved license
• The change aligns with Wolfi’s packaging and security model
• The package can be reasonably maintained over time
• There are no known unresolved security or supply-chain concerns

[Teuton-Roy]

I’d like to take this issue.

Proposed plan:

1. Verify gocover-cobertura is not already packaged (or confirm current version gap).
2. Add a new gocover-cobertura.yaml package definition with:
   • package metadata
   • Go build pipeline
   • basic runtime test
   • update tracking block
3. Validate changes locally and open a PR referencing this issue.

If that sounds good, please assign this issue to me.

[Teuton-Roy]

I reproduced the issue in a Wolfi container.

Environment

• Image: cgr.dev/chainguard/wolfi-base
• Date: 2026-05-21

Reproduction

docker run --rm -it cgr.dev/chainguard/wolfi-base sh
apk add gocover-cobertura  

ERROR: unable to select packages:
  gocover-cobertura (no such package):
    required by: world[gocover-cobertura]

[Teuton-Roy]

Hi ,
@jackwhelpton can I start work on this issue?

[jackwhelpton]

Hi , @jackwhelpton can I start work on this issue?

I'm not involved with the maintenance of this repo in any way, I'm just an end user who would like to pull gocover-cobertura as a package. I'd love to see this functionality added, so of course I'm going to say yes! :)

I'm not sure what the protocol is here though, and wouldn't want you to waste time on an MR if it's going to get rejected or just sit there awaiting merge. Hopefully somebody else can weigh in on that.

[Teuton-Roy]

hi @jackwhelpton I will raise a PR, Let see what happen next..!

[Teuton-Roy]

hi @jackwhelpton ,
created a PR, lets wait for the PR marge if every thing is okay.